Feds: Pro-Russia Hactivists Target US Critical Infrastructure

darkreading
Actively Exploited

Overview

Pro-Russian hacktivists have begun targeting U.S. critical infrastructure by exploiting vulnerabilities in virtual network computing (VNC) connections within operational technology (OT) systems. While the attacks so far have not caused significant damage, experts warn that the situation could worsen as these groups continue to refine their methods. This threat is concerning because it puts essential services and infrastructure at risk, potentially leading to disruptions in vital operations. Companies managing critical infrastructure must remain vigilant and bolster their cybersecurity defenses to prevent future incidents. The evolving nature of these attacks suggests that vigilance and proactive measures are necessary to protect against more destructive outcomes.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Virtual Network Computing (VNC) connections in Operational Technology (OT) systems
  • Action Required: Companies should enhance their cybersecurity measures and monitor VNC connections for unusual activity.
  • Timeline: Ongoing since October 2023

Original Article Summary

So far the attacks, which compromise virtual network computing (VNC) connections in OT systems, have not been particularly destructive, but this could change as they evolve.

Impact

Virtual Network Computing (VNC) connections in Operational Technology (OT) systems

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since October 2023

Remediation

Companies should enhance their cybersecurity measures and monitor VNC connections for unusual activity.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Critical.

Related Coverage

Researcher Drops YellowKey, GreenPlasma Windows Zero-Days

SecurityWeek

A security researcher has disclosed two serious vulnerabilities in Windows, known as YellowKey and GreenPlasma. YellowKey is a BitLocker bypass that allows unauthorized access to encrypted drives, but it requires physical access to the device. GreenPlasma, on the other hand, enables attackers to elevate their privileges to System level, potentially giving them full control over the affected system. These vulnerabilities pose a significant risk to users and organizations that rely on Windows for sensitive tasks. Companies should assess their physical security measures and apply necessary updates to protect against these risks.

May 14, 2026

New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption

The Hacker News

A new variant of a local privilege escalation vulnerability in the Linux kernel, named Fragnesia, has been identified. This vulnerability, tracked as CVE-2026-46300 with a CVSS score of 7.8, allows local attackers to gain root access through page cache corruption. This marks the third such vulnerability discovered in the Linux kernel within just two weeks, raising concerns for users and administrators. The flaw is rooted in the kernel's XFRM component, which is responsible for managing IPsec protocols. This means that systems using affected kernel versions could be at risk if not addressed promptly, as attackers could exploit this vulnerability to gain elevated privileges and potentially take control of vulnerable systems.

May 14, 2026

18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE

The Hacker News

Researchers have identified multiple vulnerabilities in NGINX Plus and NGINX Open, including a severe flaw that has existed for 18 years. The most critical issue, a heap buffer overflow in the ngx_http_rewrite_module (CVE-2026-42945), could allow attackers to execute arbitrary code remotely without authentication. This vulnerability has a high severity score of 9.2 on the CVSS v4 scale. Organizations using these web servers are at risk, as the flaw could lead to significant security breaches. It is crucial for affected users to address this vulnerability promptly to safeguard their systems.

May 14, 2026

Machine identities outnumber humans 109 to 1

Help Net Security

A recent report from Palo Alto Networks reveals that organizations currently manage an average of 109 machine identities for every human identity, with this number expected to rise significantly in the coming years. The report predicts an 85% growth in AI agents over the next year, contributing to a projected 77% increase in machine identities overall. In contrast, human identities are expected to grow by 56%. This imbalance raises concerns about how organizations are securing these machine identities, especially as they become more prevalent in business operations. The findings underscore the need for companies to enhance their identity security measures across the entire lifecycle of AI agents to mitigate potential risks associated with this rapid growth.

May 14, 2026

Researchers say AI just broke every benchmark for autonomous cyber capability

CyberScoop

Recent studies by independent researchers indicate that AI models, specifically Anthropic's Claude Mythos Preview and OpenAI's GPT-5.5, have significantly exceeded all previously established benchmarks for autonomous cyber capabilities. This advancement raises questions about whether this performance is a temporary spike or a new standard in AI development. The implications for cybersecurity are profound, as these AI systems may enhance the capabilities of both defenders and attackers in the cyber landscape. As organizations adapt to this shift, they need to consider how these advancements could affect their security strategies and the potential risks involved. The ongoing evolution of AI in cybersecurity could redefine the nature of cyber threats and defenses, making it crucial for companies to stay informed and prepared.

May 13, 2026

West Pharmaceutical says hackers stole data, encrypted systems

BleepingComputer

West Pharmaceutical Services has reported a cyberattack that compromised its systems, leading to data theft and the encryption of files. The company revealed that attackers gained access to sensitive information, although specific details about the stolen data have not been disclosed. This incident raises concerns about the security of pharmaceutical supply chains and the potential impact on patient safety. Companies in the healthcare sector, like West, must prioritize cybersecurity measures to protect against such threats. The attack underscores the ongoing risks faced by organizations handling sensitive data in an increasingly digital world.

May 13, 2026